This article was produced in collaboration with Court Watch, an independent outlet that unearths overlooked court records.
The U.S. government has indicted alleged members of a criminal group that uses insiders at Walmart and other techniques to commit “refund fraud” on a massive scale, according to recently unsealed court records. In short, the scam involves someone ordering an item from, say, Amazon—which in this case says it lost $700,000—receiving the item, and then using one of various tricks to get their money back from the retailer. The person is then free to sell the item online, and the criminal group takes a fee.
The indictment as well as 404 Media’s own research into refund fraud reveals a professionalized ecosystem of sellers and people providing various services as part of the wide-reaching scam. As well as malicious insiders, refund scammers take advantage of customer service representatives and online retailers’ lax refund policies to get expensive items for free. This is not a crime whose only victims are giant retailers, who may garner little sympathy. Delivery drivers, who already have very difficult jobs, are often dinged for misdelivering or failing to deliver a package, which is something these types of scams often rely on.
The specific group named in the indictment is called Artemis Refund Group or ARG. A Telegram user called Vaelxn, who the indictment lists as the owner of ARG at some point in time, told 404 Media they hadn’t heard about the case until 404 Media reached out to them.
When asked in a Telegram message if they were concerned, they said “yes definitely, I’d be lying if I were to say no.”
The indictment describes refund scams as when people “purchase an item, have the purchase refunded, and, through various means, keep the refunded item for personal use or sell for profit.” These services are often advertised on Reddit and the hacking forum Cracked, as well as on individual Telegram channels. In some cases, Refund-as-a-Service scammers take control over their customers’ retail accounts, which can make it really difficult for retailers to detect what’s happening: “Previously legitimate customers with no history of fraud can enlist highly experienced fraudsters to perpetrate this fraud on their behalf,” the court record adds.
ARG turned that scam into a business. First on its Telegram channel, ARG recruited people to place orders with retail outlets for “high-end items,” which ARG then triggered a refund for, claiming that the item either never arrived or arrived in a defective state, the indictment reads. The person who ordered the item would get to keep the product and receive a refund, and ARG would charge a fee of 15 to 20 percent of the purchase price, the document adds. ARG then tracked its refunds in spreadsheets, the indictment reads.
The indictment reveals some of the specifics about so-called “Did Not Arrive” or “DNA” scams, methods for which are often discussed openly on Reddit, Discord, hacking forums, and in Telegram chats. DNA scams can be very simple: A customer tells an online retailer that a package didn’t arrive (even though it actually did), and the retailer either refunds the order or sends a second item. These scams prey on the fact that retailers want to provide good customer service, and the fact that packages are sometimes lost or misdelivered, or are stolen by porch pirates.
DNA scams are part of a larger ecosystem of “refunding” scams that, essentially, are systematic ways of lying to online retailers in both straightforward and sophisticated ways. 
Last week, before we learned about the arrests, 404 Media was researching refunding scams on the illegallifeprotips2 subreddit, which has more than 100,000 subscribers. One post by a moderator on that subreddit from three months ago explains different strategies for different retailers. For Amazon, for example, the moderator wrote that scammers should “wait one day after the item has been marked delivered, and contact their live chat” and tell them the delivery didn’t arrive, or that it was stolen from the porch. “If they ask for a police report you can either make a false one if you so desire, since the police are never going to prioritize or even search such matters. Or you can find another agent until they instantly refund you.”
Users are constantly updating each other about which retailers they’re having luck with and which ones have begun to refuse to refund orders. Recent tips suggest that Walmart will often refund scammers who have a Walmart+ account and are buying groceries, but not other items. The SNKRS app run by Nike, meanwhile, is “easier than Amazon,” and scammers should just tell Nike that their package was stolen and needs to be replaced or refunded. 404 Media found at least six active subreddits dedicated to refund scams.
DNA scams work in part because package theft has become such a big problem for massive retailers like Amazon, and Amazon has largely been willing to refund or send a second set of items to people who have had their packages stolen. People posting tips about doing DNA scams often tell people to say that their package was stolen, and to try this tactic with multiple customer service representatives until one of them is willing to issue a refund. Package theft has become such a big problem for companies like Amazon that it has integrated Ring cameras into its broader loss prevention ecosystem and has encouraged customers to share footage with local police and has footage-sharing deals with local police around the country. It has also set up “sting operations” with police where empty boxes have been delivered to see if people steal them.
DNA scams are just the tip of the iceberg, however.
ARG also tricked the target retailers in a variety of different ways. They include mail-in-fraud, where participants would send an empty package or another item to the retailer. And, in a more sophisticated method, ARG would conduct “fake tracking identification number” (FTID) fraud, where the retailer would provide a shipping label for the return, and ARG would then manipulate the label to have it sent to another address. The retailer was then notified the item was shipped, but it never arrived back at the retailer, the indictment says.
Specific companies have popped up to make “Fake Tracking IDs” in which a shipping label is altered so that a “returned” item is scanned by a shipping service but doesn’t actually go back to the retailer, or where an empty box is sent back to the retailer. Because it’s been marked as shipped and then delivered, a lot of retailers will issue a refund anyway. Other scammers offer “scanning services” where a shipping label is scanned and can even be marked as delivered (or not delivered, depending): “A scanning service can make it look like a package was refused and returned to the store it was purchased from by combining a Return to Sender or damaged scan with a delivery scan, using the store’s address and a fake signature. This strengthens the refund fraudster’s case for a refund to be provided for their customer.”
The indictment also says that to help facilitate the scam, unindicted co-conspirators “recruited insiders from the return department at Walmart.” Walmart acknowledged a request for comment but did not provide a response in time for publication.
In one example of this process, in February 2023, a confidential human source (CHS) contacted an ARG Telegram user called VaelSupport. VaelSupport said they would process the fraudulent refund once the CHS purchased a Kate Spade handbag for just under $550, according to the indictment. By mid-March, the CHS received confirmation that the handbag had been refunded, and VaelSupport provided a Bitcoin address to send the fee to. The indictment includes another example involving a Macbook Pro from Amazon. Amazon acknowledged a request for comment but did not provide a response in time for publication.
ARG has done this thousands of times since at least April 2019, with some items being sold on eBay and Mercari, according to the indictment. One defendant appears to be connected to so many refunds that they needed “mobile storage units” to “store refunded merchandise.” ARG also collaborated with other refund groups, including one called Deathstroke, the indictment says.
Amazon said its losses from this conspiracy were more than $700,000, the indictment says. More generally, other retailers estimate they’ve lost millions of dollars to refund fraud, it adds.
The court record names ten people authorities allege are connected to ARG. They are Wyatt Douglas Miller, Kevin Ramses Rocha, Tyler Dewayne Rogers, Jonah Maxwell Fesman, Antonio Ernesto Munoz, Juan Manuel Camachozarate, Cameron David Martin, Ilyess Hadri Talbi, Steven Lin, and Gilbert Immanuel. Specifically ARG is charged with committing wire fraud.
Other representatives and customers of ARG did not respond to requests for comment from 404 Media sent over Telegram and email.
The specific Telegram group in the court records does not appear to exist any longer. Vaelxn said it wasn’t them that took it down, and did not reply when 404 Media asked who did. Vaelxn said they quit the world of refund scams a year or so ago.